The conventional riser disconnect systems are based on either an operator initiated emergency disconnect system requiring the active intervention of an operator (by the push of a button) and automatic disconnect systems based on a weak link placed in the riser system which is designed to fail mechanically in an emergency scenario before any other critical components fail. Such disconnect systems are typically referred to as “weak links”.
The key purpose of a weak link is to protect the well barrier(s) or other critical structure(s) interfacing the riser in accidental scenarios, such as heave compensator lock-up or loss of rig position which may be caused by loss of an anchor (dragged anchor), drift-off, where the rig or ship drifts off location because the rig or ship loses power, or drive-off, which is a scenario where the dynamic positioning system on the rig or ship fails for any reason causing the ship to drive off location in any arbitrary direction. In such accidental scenarios operators will have very limited time to recognize that an accident is happening and to trigger a release of the riser from the well or other critical structure(s) attached to the riser. In such accidental scenarios where the operators do not have reasonable time to react to an accident the weak link shall ensure that the integrity of the well barrier(s) or other critical interfacing structure(s) is/are protected.
When a riser is connected to a wellhead, a X-mas tree (or a lower riser package with a X-mas tree) is landed and locked onto the wellhead. The riser system is then fixed to the well on the seabed in the lower end. The upper end of the riser is typically suspended from a so-called heave compensator 1 and/or riser tensioning system in the upper end as illustrated in FIG. 1. The riser tensioning system applies top tension to the riser 2 and is connected to a heave compensator 1 which compensates for the relative heave motion between the vessel 3 (e.g. a rig or a ship) moving in the waves and the riser fixed to the seabed 4. The heave compensator system 1 is typically based on a combination of hydraulic pistons and pressurized air accumulators (not shown). The hydraulic pistons are driven actively up and down by a hydraulic power unit in order to compensate for the vertical motion of the vessel 3 in the waves. The air accumulators are connected to the same system and are used to maintain a relatively constant tension in the system. This is done by suspending the risers from cylinders resting on a pressurized air column, where the pressure is set according to the load in the system. The volume of the air accumulators and the stroke of the cylinders will then define the motion hysteresis and therefore the tension in the system as the vessel 3 moves vertically in the waves.
A compensator lock-up refers to a scenario where the heave compensation system fails, causing the heave compensator cylinders to lock and thereby failing to compensate for the heave motion between riser 2 and vessel 3, ref. FIG. 2. This may result in snag loads and excessive tension forces on the riser 2. Such snag loads may cause damage to well barrier(s) 5 or other interfacing structure(s). A weak link in the riser 2 will, when properly designed, protect the well barrier(s) 5 from damage in case of a compensator lock-up occurring.
Loss of position occurs when the vessel 3 fails to maintain its position within defined boundaries above the wellhead. Anchored vessels 3 usually experience loss of position caused by loss of one or more anchors. For dynamically positioned (DP) vessels, loss of position is normally caused by DP failure or by operator error causing the vessel 3 to drive-off from its intended position. In a drift-off scenario the vessel either does not have sufficient power to stay in its position given the current weather conditions, or vessel power is lost and the vessel will drift off in the direction of the wind, waves and currents. All such accidental scenarios result in excessive vessel 3 offset relative to well barrier(s) 5, ref. FIG. 3. When the position of the vessel moves outside the allowable boundaries, the resulting riser angle α in combination with riser tension will induce high bending moments in the lower and upper part of the riser 2. Furthermore as the relative distance between the vessel 3 and the well barrier(s) 5 on the seabed increases, the heave compensator cylinder will stroke out to compensate an otherwise increase in tension. Subsequently the heave compensator 1 will stroke out, leading to a rapid increase in the riser tension. When this occurs the relative angle α between the well barrier(s) 5 on the seabed 4 and the vessel 3 will have increased significantly and the rapid tension increase will cause high bending moments in the well barrier(s) 5.
To protect the well barrier(s) 5 in the mentioned accidental scenarios, a weak link needs to disconnect the riser 2 from the well barrier(s) 5 prior to exceeding the well barrier(s) 5 capacity in bending, ref. FIG. 5.
Exceeding the load capacity of the well barrier(s) 5 may involve damage of the well head, damage inside the well, damage on the riser 2 etc., all of which are considered to be serious accidental scenarios with high risk towards personnel and the environment.
Damage of the a well barrier(s) 5 may result in costly and time consuming repair work, costly delays due to lack of progress in the operation, and last, but not least, environmental and human risks in the form of pollution, blow-outs, explosions, fires, etc. The ultimate consequence of well barrier damage is a full scale subsea blow-out, with oil and gas from the reservoir being released directly and uncontrollably into the ocean. If the down-hole safety valve should fail or be damaged in the accident, there are no more means of shutting down the well without drilling a new side well for getting into and plugging the damaged well.
The challenges with existing weak link designs are related to the combination of fulfilling all design requirements (safety factors, etc.) during normal operation of the system, and at the same time ensuring reliable disconnect of the system in an accidental scenario.
The most common weak link concepts today rely on structural failure in a component or components. Typical designs involve a flange with bolts that are designed to break at a certain load, or a pipe section that is machined down over a short length to cause a controlled break of the riser in that location.
Most conventional weak links that are in use today only rely on tension forces, i.e. a given weak link is designed to break at a certain, pre-defined tension load. However, the emergency situations that arise do not involve tension forces alone. In the case of e.g. a drift-off, there will be significant bending moments introduced into the well barrier(s) 5 in addition to the tension forces. Even in a heave compensator lock-up scenario, bending moments acting on the well barrier(s) 5 may be significant due to the rig/vessel offset within the allowable operation window. It is not uncommon that the weather window for an operation is limited because the weak link can only accommodate a certain vessel offset in normal operation. Vessel station keeping ability above the well will be reduced with increasing winds and waves and normal variations in the position of the rig above the well will increase. If the offset exceeded a certain limit the weak link will not protect the well barrier(s) 5 in case of a heave compensator lock-up. Therefore, the ability of the weak link to fail due to bending may affect the weather window of the operation.
FIG. 4 illustrates the challenges linked to designing a weak link which is based on structural failure, e.g. the conventional breaking of weakened flange bolts or the like. The illustration shows a system where the nominal system tension in the weak link is 100 T (1 T=1 ton=1000 kg). The system shall work under pressure and the end cap effect of the pressure increases the tension to more than 200 T which the weak link needs to be designed for. In the design of the weak link, safety factors and spread in material properties has to be allowed for thus increasing the actual capacity of the part to more than 400 T. The weak link will normally also have to accommodate a certain bending moment in normal operation, which in the illustration mentioned above, has increased the structural capacity of the weak link to around 500 T. This means that in the example above, a weak link designed for a maximum operational tension of 100 T and a given bending moment, cannot be designed with a breaking load less than 500 T. In some cases the gap between design load and the minimum possible breaking load is greater than the allowable capacity in the well barrier(s), thus requiring a reduction in the operational capacities, which again reduces the operational envelopes. As the examples shows, the fact that the weak link shall be designed for full pressure, but at the same time shall work as a weak link when there is no pressure in the system, will for a high pressure system contribute significantly to the gap between the operational design load and the minimum breaking load in a weak link based on structural failure.
In additional, to the technical challenges related to existing weak link solutions based on structural failure, there are also schedule and cost challenges related to the conventional systems. A weak link based on structural failure requires a comprehensive qualification program for each project and typically imposes stringent requirements on material deliveries to control material properties of the parts designed to fail. These qualification programs and the additional requirements for particular material properties are often a challenge with respect to project schedules.
FIG. 5 shows a typical capacity curve for combined loading for well barrier(s) 5 being defined by a straight line along which all safety factors in the well barrier design have been fully utilized. This line does not represent the structural failure of the well barrier(s), but indicates the calculated allowable capacity of the well barrier(s) 5. If the combined loads exceed this line there is no guarantee for the integrity of the well barrier(s), and it is likely that the barrier(s) is(are) damaged and possible leaks may occur.
FIG. 6 illustrates how the loads in the riser 2 and in the well barrier(s) 5 develop in a loss of position scenario. When the rig 3 loses its position the load in the riser 2 will initially remain constant, because the heave compensator will stroke out to maintain a constant load in the riser. Once the heave compensator 1 strokes out, the tension in the riser 2 will increase rapidly as shown in the upper load diagram. The load in the well barrier(s) 5 will also remain close to constant while the heave compensator 1 strokes out (there will be some increase in the bending loads in the barrier(s)) and when the heave compensator 1 stops the axial load in the riser 2 will increase rapidly causing very high bending loads in the well barrier(s) 5. In such accidental scenarios existing weak links relying on structural failure in a riser component will typically reach its structural capacity curve long after having exceeded the design load capacity curve of the well barrier(s).